Custom OIDC providers are supported to mostly address your 3rd party auth concerns.

https://tailscale.com/kb/1240/sso-custom-oidc/